keyStore.setKeyEntry("private", heldCertificate.keyPair.private, password, chain)
    }

    // https://github.com/bcgit/bc-java/issues/1160
    val isBouncyCastle = keyStore.provider.name == "BC"
    val algorithm = if (isBouncyCastle) "PKIX" else KeyManagerFactory.getDefaultAlgorithm()

    val factory = KeyManagerFactory.getInstance(algorithm)
    factory.init(keyStore, password)

    val response = call.execute()
    assertThat(response.isSuccessful).isTrue()

    val recordedRequest = server.takeRequest()
    // https://github.com/bcgit/bc-java/issues/1773
    if (!platform.isBouncyCastle()) {
      assertThat(recordedRequest.handshakeServerNames).containsExactly(url.host)
    }
  }

  /**
   * Use different hostnames for the TLS handshake (including SNI) and the HTTP request (in the

    fun isJdk9() = getPlatformSystemProperty() == JDK9_PROPERTY

    fun isJdk8() = getPlatformSystemProperty() == JDK8_PROPERTY

    fun isJdk8Alpn() = getPlatformSystemProperty() == JDK8_ALPN_PROPERTY

    fun isBouncyCastle() = getPlatformSystemProperty() == BOUNCYCASTLE_PROPERTY

    fun isOpenJsse() = getPlatformSystemProperty() == OPENJSSE_PROPERTY

    fun isLoom() = getPlatformSystemProperty() == LOOM_PROPERTY

      """.trimMargin()
    val heldCertificate = decode(certificatePem + pkcs8Pem)
    assertThat(heldCertificate.certificatePem()).isEqualTo(certificatePem)

    // Slightly different encoding
    if (platform.isBouncyCastle()) {
      assertThat(heldCertificate.privateKeyPkcs8Pem()).isEqualTo(bcPkcs8Pem)
    } else {
      assertThat(heldCertificate.privateKeyPkcs8Pem()).isEqualTo(pkcs8Pem)
    }